| Filename | Latest commit message | Latest commit date |
|---|---|---|
db65d20be0
`cargo audit` over all 47 workspace lockfiles reported 142 vulnerability instances. The dangerous ones were not exotic: the S2 executor was pinned to wasmtime 43.0.2, which carries eight advisories including RUSTSEC-2026-0379 (9.9), -0327 (9.3) and -0269 (8.8). That crate is the one component whose whole job is to execute untrusted guest code, so a sandbox-escape class defect there is not a dependency hygiene matter — it is the confinement claim itself. wasmtime moves 43.0.2 -> 49.0.4, the single version every one of the eight advisories names as patched (50.0.0 exists but no advisory lists it as fixed, so it is not yet the safe choice). WASMTIME_VERSION is updated with it: the constant is attested into the mechanism commitment under SPEC §7.9, so leaving it stale would attest confinement to a runtime that did not run. The crate's own `wasmtime_version_matches_the_lockfile` test enforces that pairing. The rest are semver-compatible bumps carrying no API change: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots/webpki-root-certs 1.0.10, quinn-proto 0.11.18 (RUSTSEC-2026-0340/-0343, both 7.5), tokio 1.54.1, crossbeam-epoch 0.9.20, rtrb 0.3.5. Not fixed here, and deliberately so rather than silently: zip (>=9.0.0), hpke-rs (>=0.6.0), quick-xml (>=0.41.0) and libcrux-kem (>=0.0.10) are all semver-major moves, three of them transitive, so each needs its dependent assessed on its own. rsa RUSTSEC-2023-0071 has no fixed version at all. Co-Authored-By: Claude Opus 5 <[email protected]> |
||
| .. | ||
| capabilities | ||
| icons | ||
| src | ||
| .gitignore | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| README.md | ||
| tauri.conf.json | ||
Quantum Studio for the desktop
Quantum Studio as an app. The interface is the browser's. The engine underneath is the quantum job service's engine (wai_quantum::engine), built natively: it uses every core, holds as much memory as the machine has, and works offline.
- Each job runs in a process of its own, this binary run as
worker, so a large job cannot take the app's memory with it, and Cancel ends it. - The worker plans and runs; the app seals. It signs the answer with this user's key, the command line's (
~/.config/wai/quantum-key), which never leaves the app. - Saved jobs and programs go to
~/Documents/Quantum Studio/.wai-quantum verifychecks a saved job. - The job service is one switch away, as in the browser.
- Memory: a job may take
$WAI_QUANTUM_MEMORY_GB(16 by default). The plan says when a job needs more.
Building
The app embeds the Studio's build, so build the Studio first:
(cd ../quantum-studio && npm ci && node build.mjs)
cargo build --release # add --features metal for the GPU state vector on macOS
./target/release/wai-quantum-desktop # the app
./target/release/wai-quantum-desktop check # a job through the worker, sealed and verified, with no window
It draws with the operating system's own web view, so the app carries no browser of its own. Installers for macOS, Windows and Linux come from cargo tauri build.